chore(deps): update dependency posthog-node to v5.48.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
posthog-node (source)	5.11.2 → 5.48.1

---

Release Notes

PostHog/posthog-js (posthog-node)

v5.48.1

Compare Source

Patch Changes

• #​4346 4751b33 Thanks @​marandaneto! - Enforce configured request timeouts while consuming Capture V1 response bodies.
  (2026-08-06)

• #​4423 64ba193 Thanks @​marandaneto! - Use Node's zlib gzip implementation for Node SDK payloads to avoid sustained memory growth from frequent Web Streams compression.
  (2026-08-06)

• Updated dependencies [64ba193]:

  • @​posthog/core@​1.46.9

v5.48.0

Compare Source

Minor Changes

• #​4342 fa3457f Thanks @​haacked! - Support the starts_with, not_starts_with, ends_with, and not_ends_with property filter operators in feature flag local evaluation. Matching is case-insensitive and mirrors icontains, so flags using these operators no longer fall back to remote evaluation.
  (2026-08-05)

v5.47.11

Compare Source

Patch Changes

• #​4380 3c40b6c Thanks @​marandaneto! - Keep request timeouts active through response body consumption and clarify eventual event UUID deduplication semantics.
  (2026-08-05)
• Updated dependencies [3c40b6c]:
  • @​posthog/core@​1.46.8

v5.47.10

Compare Source

Patch Changes

• #​4287 d3c4538 Thanks @​posthog! - Keep $referring_domain and canonical utm_*/campaign parameters on minimal $feature_flag_called events. Previously the minimal allowlist stripped every campaign parameter, so a flag-called event landing first in a session could set the session's UTM attribution and channel type to NULL in web analytics.
  (2026-08-04)
• Updated dependencies [d3c4538]:
  • @​posthog/core@​1.46.7

v5.47.9

Compare Source

Patch Changes

• #​4350 facb4c1 Thanks @​marandaneto! - Fix enableExceptionAutocapture suppressing Node's default crash on unhandled promise rejections; fatal rejections in strict or warn-with-error-code mode and rejections handled by another unhandledRejection listener are no longer captured.
  (2026-08-04)

v5.47.8

Compare Source

Patch Changes

• #​4348 d4ffb83 Thanks @​marandaneto! - Schedule local feature flag polls after each request settles.
  (2026-08-04)
• Updated dependencies [821a2c6]:
  • @​posthog/core@​1.46.6

v5.47.7

Compare Source

Patch Changes

• #​4352 1cf9c6d Thanks @​marandaneto! - Bound stack source context reads and skip non-regular or oversized files.
  (2026-08-03)

v5.47.6

Compare Source

Patch Changes

• #​4381 f3a71a1 Thanks @​marandaneto! - Clear completed lifecycle timeout handles so successful shutdowns do not leave timers running.
  (2026-08-03)
• Updated dependencies [f3a71a1]:
  • @​posthog/core@​1.46.4

v5.47.5

Compare Source

Patch Changes

• #​4155 eb0a793 Thanks @​ATKasem! - fix: personProperties and groupProperties on the feature flag methods are no longer typed as Record<string, string>, so numeric and boolean values type-check without a cast. Local evaluation already handled them — matchProperty takes Record<string, any> and compares numerically for gt/gte/lt/lte — only the public types disagreed. These now use the shared Properties type (personProperties?: Properties, groupProperties?: Record<string, Properties>), matching setPersonPropertiesForFlags/setGroupPropertiesForFlags so the any can be narrowed later. Types only, no runtime change.
  (2026-08-03)
• Updated dependencies [eb0a793]:
  • @​posthog/core@​1.46.3

v5.47.4

Compare Source

Patch Changes

• #​4347 7c3a9af Thanks @​marandaneto! - Preserve events added to a full queue while an earlier batch is being flushed.
  (2026-08-03)
• Updated dependencies [7c3a9af]:
  • @​posthog/core@​1.46.2

v5.47.3

Compare Source

Patch Changes

• #​4349 0e2b371 Thanks @​marandaneto! - Apply the feature flag definition request timeout while consuming the response body.
  (2026-07-31)

• #​4349 0e2b371 Thanks @​marandaneto! - Keep the feature flag definition request timeout active until the request settles.
  (2026-07-31)

v5.47.2

Compare Source

Patch Changes

• #​4332 b9a241e Thanks @​ioannisj! - Fix identify() leaving a user anonymous when the supplied ID already matches the persisted distinct ID (for example after a non-identified bootstrap seeded the same ID). The user is now marked identified and a person-processed $set event is captured. Ports the same fix from posthog-js (browser) to the shared core used by React Native, Node, and posthog-js-lite.
  (2026-07-31)
• Updated dependencies [b9a241e]:
  • @​posthog/core@​1.46.1

v5.47.1

Compare Source

Patch Changes

• #​4380 3c40b6c Thanks @​marandaneto! - Keep request timeouts active through response body consumption and clarify eventual event UUID deduplication semantics.
  (2026-08-05)
• Updated dependencies [3c40b6c]:
  • @​posthog/core@​1.46.8

v5.47.0

Compare Source

Minor Changes

• #​4308 6e7f3ae Thanks @​ablaszkiewicz! - Emit the release id that posthog-cli injects into your bundle as $release_id on $exception events, so PostHog can attach exceptions to a release without joining through symbol sets. Adds getInjectedReleaseId() to @posthog/core. The property is only attached when an injected release id can be read.
  (2026-07-30)

Patch Changes

• Updated dependencies [6e7f3ae]:
  • @​posthog/core@​1.46.0

v5.46.1

Compare Source

Patch Changes

• #​4234 6c8fde0 Thanks @​hpouillot! - Normalize V8 Promise combinator stack frames so input indexes are not treated as source filenames.
  (2026-07-23)
• Updated dependencies [6c8fde0]:
  • @​posthog/core@​1.45.1

v5.46.0

Compare Source

Minor Changes

• #​4172 9621830 Thanks @​haacked! - send minimal $feature_flag_called events when the server enables it

  When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

• Updated dependencies [9621830]:
  • @​posthog/core@​1.44.0

v5.45.2

Compare Source

Patch Changes

• #​4168 06d19a2 Thanks @​dustinbyrne! - Avoid Next.js Edge runtime warnings for native compression and fatal error handling.
  (2026-07-16)
• Updated dependencies [06d19a2]:
  • @​posthog/core@​1.43.1

v5.45.1

Compare Source

Patch Changes

• #​4164 9eb2b28 Thanks @​dustinbyrne! - Fix the default Node.js event flush interval at 5 seconds.
  (2026-07-16)

v5.45.0

Compare Source

Minor Changes

• #​4159 fad6d9a Thanks @​haacked! - add $feature_flag_has_experiment to $feature_flag_called events

  $feature_flag_called events now carry a $feature_flag_has_experiment boolean sourced from the server's has_experiment flag metadata (the /flags?v=2 response for remote evaluation, the /api/feature_flag/local_evaluation definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports has_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)

Patch Changes

• Updated dependencies [fad6d9a]:
  • @​posthog/core@​1.43.0

v5.44.0

Compare Source

Minor Changes

• #​4153 fc2cb2e Thanks @​eli-r-ph! - Raise the default maxQueueSize from 1000 to 10000. Backend workloads are more likely to burst-enqueue events synchronously ahead of a flush than browser/mobile clients, so the previous default risked silently dropping events under bursty load. An explicit maxQueueSize option still overrides this default.
  (2026-07-15)

Patch Changes

• Updated dependencies [fc2cb2e]:
  • @​posthog/core@​1.42.1

v5.43.0

Compare Source

Minor Changes

• #​4117 1eddff7 Thanks @​DanielVisca! - add the posthog.metrics API (count, gauge, histogram) to posthog-node — alpha

  Backend services can now record metrics through the same statsd-style pre-aggregating client the browser SDK ships, with no OpenTelemetry setup:

  const client = new PostHog('phc_...', { metrics: { serviceName: 'billing-worker' } })
  client.metrics.count('invoices.processed', 1, { attributes: { plan: 'pro' } })
  client.metrics.gauge('queue.depth', 42)
  client.metrics.histogram('job.duration', 187, { unit: 'ms' })

  Samples aggregate in memory and flush as OTLP/JSON to /i/v1/metrics (one data point per series per window). Pending metrics are flushed on shutdown(). Core gains _sendMetricsBatch on PostHogCoreStateless (same outcome contract as _sendLogsBatch) and a shared resolveMetricsConfig, so any core-based SDK can host PostHogMetrics. (2026-07-15)

Patch Changes

• Updated dependencies [1eddff7]:
  • @​posthog/core@​1.42.0

v5.42.0

Compare Source

Minor Changes

• #​4101 dc2aa5b Thanks @​posthog! - Expose the error tracking rate-limiter config via the new exceptionRateLimiterRefillRate and exceptionRateLimiterBucketSize options. Burst protection is scoped per exception type (each distinct $exception type gets its own token bucket, with no aggregate cap across types), so these let customers with high-cardinality exception types tune the per-type allowance.
  (2026-07-14)

Patch Changes

• Updated dependencies [dc2aa5b]:
  • @​posthog/core@​1.41.0

v5.41.0

Compare Source

Minor Changes

• #​4105 203284a Thanks @​eli-r-ph! - Add opt-in Capture V1 support. Set the POSTHOG_CAPTURE_MODE=v1 environment variable to submit analytics events to the Capture V1 endpoint (/i/v1/analytics/events) instead of the legacy /batch/ endpoint, on both the batched and immediate send paths. The default remains v0, so existing behavior is unchanged unless you opt in. Opt-in is env-var-only during the transition (no public option), so nothing on the API surface has to be removed when v1 later becomes the default.

  Capture V1 uses Bearer auth, lifts legacy $-sentinel properties into a typed options object, and does per-event partial retry with exponential backoff clamped against Retry-After. Dropped and undelivered events are surfaced on the client error channel as a CaptureV1Error. $ai_* events continue to use the legacy submitter for now, regardless of the capture mode.

  In v1 mode, $ai_* events are routed to an isolated in-memory queue and flushed independently of the Capture V1 queue, so the two transports never share a batch and a failure on one cannot re-send events already accepted on the other. Each queue keeps its own retry/durability semantics: the legacy queue re-queues on network failure (retrying on later flushes), while the V1 queue exhausts the sender's own attempt budget per cycle and then surfaces the failure rather than re-queuing. (2026-07-11)

Patch Changes

• Updated dependencies [203284a]:
  • @​posthog/core@​1.40.2

v5.40.0

Compare Source

Minor Changes

• #​4060 0b49a4c Thanks @​turnipdabeets! - Add secretKey config as the canonical alias for the deprecated personalApiKey (accepts a Personal API Key or Project Secret API Key).
  (2026-07-07)

v5.39.4

Compare Source

Patch Changes

• #​4047 0c11747 Thanks @​marandaneto! - Stop duplicating distinct_id inside /flags person properties.
  (2026-07-02)
• Updated dependencies [5e7e132]:
  • @​posthog/core@​1.39.5

v5.39.3

Compare Source

Patch Changes

• #​4055 64e04ba Thanks @​marandaneto! - Retry /flags requests that receive HTTP 502 or 504 responses across SDKs that use the shared core flags client.
  (2026-07-02)
• Updated dependencies [64e04ba]:
  • @​posthog/core@​1.39.4

v5.39.2

Compare Source

Patch Changes

• #​4028 a664b81 Thanks @​marandaneto! - Make Node flush() wait for pending asynchronous SDK work before draining the event queue, so events produced by helpers like captureException() are not missed. Pending work rejections no longer prevent queued events from flushing.
  (2026-07-01)
• Updated dependencies [a664b81]:
  • @​posthog/core@​1.39.3

v5.39.1

Compare Source

Patch Changes

• #​4029 b36b1cc Thanks @​marandaneto! - Call before_send for identify, group identify, and alias events.
  (2026-06-30)

• #​4027 ab118d2 Thanks @​marandaneto! - Safely serialize event batches with circular property references instead of crashing during flush.
  (2026-06-30)

• Updated dependencies [ab118d2]:

  • @​posthog/core@​1.39.2

v5.39.0

Compare Source

Minor Changes

• #​4006 0063128 Thanks @​github-actions! - Add groupIdentifyImmediate() to await the network request when identifying a group, mirroring captureImmediate/identifyImmediate/aliasImmediate. Useful in edge/serverless environments where the background queue may not flush. The Convex integration now uses it directly instead of routing $groupidentify through captureImmediate.
  (2026-06-30)

Patch Changes

• Updated dependencies [0063128]:
  • @​posthog/core@​1.39.0

v5.38.8

Compare Source

Patch Changes

• #​3974 08b404b Thanks @​mjfaga! - Fix local evaluation ignoring the in/not_in operator on cohort-based flag conditions. "Not in
  cohort" was evaluated as "in cohort", inverting cohort-exclusion flags. Now applies the operator to
  the cohort membership result. (2026-06-29)

v5.38.7

Compare Source

Patch Changes

• #​3961 619a25c Thanks @​marandaneto! - Retry feature flag requests after transient network errors only. The feature flag request retry count defaults to 1 and can be set to 0 to disable retries.
  (2026-06-29)
• Updated dependencies [619a25c]:
  • @​posthog/core@​1.38.1

v5.38.6

Compare Source

Patch Changes

• #​3896 606ef43 Thanks @​GauthierPLM! - Only stamp $groups from the top-level groups when present
  (2026-06-26)

v5.38.5

Compare Source

Patch Changes

• #​3955 8e9689a Thanks @​marandaneto! - Dedupe feature flag called events per returned flag value.
  (2026-06-24)
• Updated dependencies [8e9689a]:
  • @​posthog/core@​1.37.3

v5.38.4

Compare Source

Patch Changes

• #​3938 6391106 Thanks @​dustinbyrne! - Respect disable_capture_url_hashes when capturing Express and NestJS request URLs.
  (2026-06-23)

v5.38.3

Compare Source

Patch Changes

• #​3937 4d59d0e Thanks @​marandaneto! - Deprecate the Node SDK Sentry integration and point users to PostHog Error Tracking for Node.
  (2026-06-23)
• Updated dependencies [440e370]:
  • @​posthog/core@​1.37.0

v5.38.2

Compare Source

Patch Changes

• #​3903 6b21f77 Thanks @​marandaneto! - Validate custom event UUID overrides and generate new UUIDs when invalid.
  (2026-06-19)
• Updated dependencies [6b21f77]:
  • @​posthog/core@​1.35.3

v5.38.1

Compare Source

Patch Changes

• #​3886 e6d7fe2 Thanks @​marandaneto! - Stop sending deprecated no-op top-level type, library, and library_version fields in event batch payloads. Use properties.$lib and properties.$lib_version for SDK metadata; legacy queued library and library_version values are used as fallbacks when the official $ properties are missing.
  (2026-06-18)
• Updated dependencies [e6d7fe2]:
  • @​posthog/core@​1.35.2

v5.38.0

Compare Source

Minor Changes

• #​3845 a0553b3 Thanks @​marandaneto! - Add setPersonProperties() and unsetPersonProperties() helpers to manage person properties from the Node.js SDK.
  (2026-06-16)

Patch Changes

• Updated dependencies [b3ec845, c6c163a]:
  • @​posthog/core@​1.33.0

v5.37.1

Compare Source

Patch Changes

• #​3837 29bf8e3 Thanks @​marandaneto! - Add missing bugs metadata to package manifests.
  (2026-06-15)
• Updated dependencies [29bf8e3]:
  • @​posthog/core@​1.32.4

v5.37.0

Compare Source

Minor Changes

• #​3705 d6fc0a5 Thanks @​gustavohstrassburger! - feat(feature-flags): support the early_exit condition option in local evaluation. When a flag enables early exit, evaluation now stops and returns false as soon as a condition group's property filters match but the rollout percentage excludes the user, instead of falling through to later groups — matching the server-side evaluation behavior.
  (2026-06-12)

v5.36.17

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.32.3

v5.36.16

Compare Source

Patch Changes

• Updated dependencies [25822ac]:
  • @​posthog/core@​1.32.2

v5.36.15

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.32.1

v5.36.14

Compare Source

Patch Changes

• Updated dependencies [612f97a]:
  • @​posthog/core@​1.32.0

v5.36.13

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.31.4

v5.36.12

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.31.3

v5.36.11

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.31.2

v5.36.10

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.31.1

v5.36.9

Compare Source

Patch Changes

• Updated dependencies [0c2acb9]:
  • @​posthog/core@​1.31.0

v5.36.8

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.14

v5.36.7

Compare Source

Patch Changes

• #​3748 7820929 Thanks @​marandaneto! - Reduce duplicate internal code found by dry4ts.
  (2026-06-09)
• Updated dependencies []:
  • @​posthog/core@​1.30.13

v5.36.6

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.12

v5.36.5

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.11

v5.36.4

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.10

v5.36.3

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.9

v5.36.2

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.8

v5.36.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.7

v5.36.0

Compare Source

Minor Changes

• #​3728 9287c87 Thanks @​turnipdabeets! - Add a configurable $is_server event property (default true) so PostHog can identify server-side events. Set isServer: false when using the SDK as a client/CLI so the device OS is attributed normally.
  (2026-06-04)

v5.35.15

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.6

v5.35.14

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.5

v5.35.13

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.4

v5.35.12

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.3

v5.35.11

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.2

v5.35.10

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.30.1

v5.35.9

Compare Source

Patch Changes

• #​3703 f3cc6fa Thanks @​marandaneto! - Disable/no-op initialization paths instead of throwing or sending requests when PostHog project tokens are missing or blank.
  (2026-06-01)
• Updated dependencies [3d4a76f]:
  • @​posthog/core@​1.30.0

v5.35.8

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.29.15

v5.35.7

Compare Source

Patch Changes

• Updated dependencies [d9ad199]:
  • @​posthog/core@​1.29.14

v5.35.6

Compare Source

Patch Changes

• #​3681 7b84b75 Thanks @​ablaszkiewicz! - unify captureException in posthog core
  (2026-05-28)
• Updated dependencies [7b84b75]:
  • @​posthog/core@​1.29.13

v5.35.5

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.29.12

v5.35.4

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.29.11

v5.35.3

Compare Source

Patch Changes

• Updated dependencies [5568f12]:
  • @​posthog/core@​1.29.10

v5.35.2

Compare Source

Patch Changes

• #​3658 5d7a2d3 Thanks @​gustavohstrassburger! - Include group context in the $feature_flag_called deduplication key in _captureFlagCalledEventIfNeeded, so events fire independently per group combination.
  (2026-05-25)

v5.35.1

Compare Source

Patch Changes

• Updated dependencies [c806cca]:
  • @​posthog/core@​1.29.9

v5.35.0

Compare Source

Minor Changes

• #​3642 18ea8b5 Thanks @​dustinbyrne! - Promote feature flag definition cache provider types to the main posthog-node export and deprecate posthog-node/experimental imports.
  (2026-05-21)

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.29.8

v5.34.10

Compare Source

Patch Changes

• #​3643 f42f371 Thanks @​dmarticus! - Reject semver values with leading zeros in local flag evaluation. Per semver 2.0.0 §2, numeric identifiers must not include leading zeros — values like 1.07.3 are not valid semver and should not match targeting conditions. Both override values and flag values are now validated; invalid inputs surface as InconclusiveMatchError so the condition does not match.
  (2026-05-21)

v5.34.9

Compare Source

Patch Changes

• Updated dependencies []:
  • @​posthog/core@​1.29.7

v5.34.8

Compare Source

Patch Changes

• #​3640 12ef3f6 Thanks @​hpouillot! - Fix identifyImmediate to await the underlying network request. Previously the returned promise resolved before the $identify event was sent, causing events to be dropped when called from short-lived runtimes (Vercel/Cloudflare Workers, Convex actions) that exit immediately after await.
  (2026-05-21)

v5.34.7

Compare Source

Patch Changes

• Updated dependencies [a880dbc]:
  • @​posthog/core@​1.29.6

[v5.34.6](https://redirect.github.com/PostHog/posthog-js/blob/HEAD/packages/node/C

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.